The Unified Data Connector module allows you to configure an S3 bucket as a source using IAM roles, ensuring secure data sharing without exposing AWS Access Key ID and Secret Key. IAM roles can be configured to connect Unified Data Connector with the S3 bucket.

This article consists of the following sections:

• Configuring S3 bucket for AWS environment

• Configuring S3 bucket for GCP environment

• Configuring S3 bucket for Azure environment

Configuration Process

In Sprinklr, applications run on three types of cloud storage services: Amazon AWS, Microsoft Azure, and Google Cloud Storage. The configuration steps vary based on the platform's operating environment.

The following table lists the environments and the corresponding cloud storage service on which they are hosted:

Configuring S3 bucket for AWS environment

Perform the following steps to configure S3 bucket for AWS anvironment.

Step 1: Define a Trust Relationship in Your S3 Bucket’s IAM Role

To allow Sprinklr to access the IAM role associated with your S3 bucket, you need to update the Trust Policy.

1. Navigate to the AWS IAM Console and then click Roles.

2. Select the IAM Role that has access to your S3 bucket.

3. Click on the Trust Relationships tab and then click Edit trust policy.

4. Ensure the policy includes the ARN of the role provided by Sprinklr and grants permission for Sprinklr’s role to inherit it.

   {

   "Version": "2012-10-17",

   "Statement": [

   {

   "Effect": "Allow",

   "Principal": {

   "AWS": "arn:aws:iam::<Sprinklr-Account-ID>:role/<Sprinklr-Role-Name>"

   },

   "Action": "sts:AssumeRole"

   }

   ]

   }

   Note: Sprinklr provides the ARN of the IAM role that needs access to your S3 bucket. This configuration allows Sprinklr to inherit the role and interact with S3 data securely.

   1. Click Update Trust Policy to save the changes.

      ​

      The following table lists the IAM roles and the respective AWS Prod environments. Enter the following IAM role in the Source Specific Settings screen of UDC based on the AWS prod enviornment.

      AWS environment	IAM role
      Prod4	arn:aws:iam::170450182475:role/spr-prod4-data-connector
      Prod5	arn:aws:iam::637423527104:role/spr-prod5-data-connector
      Prod6	arn:aws:iam::283016501690:role/spr-prod6-data-connector
      Prod11	arn:aws:iam::365282317173:role/spr-prod11-data-connector
      Prod12	arn:aws:iam::869367471674:role/spr-prod12-data-connector
      Prod15	arn:aws:iam::653661179041:role/spr-prod15-data-connector
      Prod21	arn:aws:iam::195275654930:role/spr-prod21-data-connector

Step 2: Assign Required Permissions to the Role

​

Ensure that the IAM role associated with your S3 bucket has the necessary permissions for Sprinklr to fetch, store, and manage files.

1. Navigate to AWS IAM Console → Roles → Permissions.

2. Attach a policy that grants atleast the following S3 permissions:

   s3:GetObject (Read access)

   s3:PutObject (Write access)

   s3:DeleteObject (Delete access)

3. Save the policy.

Step 3: Verify Access with Sprinklr

Enter the IAM role ARN in the Source Specific Settings screen while configuring Unified Data Connector.

Configuring S3 bucket for GCP environment

Perform the following steps to configure S3 bucket for GCP anvironment

Step 1: Define a Trust Policy in Your S3 Bucket’s IAM Role

To allow Sprinklr to access the IAM role associated with your S3 bucket, you need to update the Trust Policy.

1. Navigate to AWS IAM Console → Roles.

2. Select the IAM role that is associated with your S3 bucket.

3. Click on the Trust Relationships tab and then select Edit trust policy.

4. Update the trust policy by adding the following condition:

   {

   "Version": "2012-10-17",

   "Statement": [

   {

   "Effect": "Allow",

   "Principal": {

   "Federated": "accounts.google.com"

   },

   "Action": "sts:AssumeRoleWithWebIdentity",

   "Condition": {

   "StringEquals": {

   "accounts.google.com:sub": "{sub}"

   }

   }

   }

   ]

   }

   Note:

   • The values for {tenant}, {aud}, and {sub} are listed in a table in Step 2.

   • These values ensure that only authorized requests from Sprinklr’s environment in GCS can access your bucket.

5. Click Save Policy to apply the changes.

Step 2: Assign Required Permissions

Ensure that the IAM role associated with your S3 bucket has the following permissions for Sprinklr’s access:

• s3:GetObject (Read access)

• s3:PutObject (Write access)

• s3:DeleteObject (Delete access)

If necessary, update the Bucket Policy under Amazon S3 Console → Permissions → Bucket Policy and add the appropriate actions.

The following table lists the Tenant ID for respective prod environments: bc14634e-db9f-4229-8cf0-68a87acd2f98

Step 3: Verify Access with Sprinklr

Enter the IAM role ARN in the Source Specific Settings screen while configuring Unified Data Connector.

Configuring S3 bucket for Azure environment

Perform the following steps to configure S3 bucket for Azure anvironment

Step 1: Define a Trust Policy in Your S3 Bucket’s IAM Role

To allow Sprinklr to access the IAM role associated with your S3 bucket, you need to update the Trust Policy.

1. Navigate to AWS IAM Console → Roles.

2. Select the IAM role that is associated with your S3 bucket.

3. Click on the Trust Relationships tab and then select Edit trust policy.

4. Update the trust policy by adding the following condition:

   "Condition": {

   "StringEquals": {

   "sts.windows.net/{tenant}/:aud": [

   "{aud}"

   ],

   "sts.windows.net/{tenant}/:sub": "{sub}"

   }

   }

   Note:

   • The values for {tenant}, {aud}, and {sub} are listed in a table in Step 2.

   • These values ensure that only authorized requests from Sprinklr’s environment in Azure Blob can access your bucket.

5. Click Save Policy to apply the changes.

Step 2: Assign Required Permissions

Ensure that the IAM role associated with your S3 bucket has the following permissions for Sprinklr’s access:

• s3:GetObject (Read access)

• s3:PutObject (Write access)

• s3:DeleteObject (Delete access)

If necessary, update the Bucket Policy under Amazon S3 Console → Permissions → Bucket Policy and add the appropriate actions.

The following table lists the Tenant ID for respective prod environments: bc14634e-db9f-4229-8cf0-68a87acd2f98

Step 3: Verify Access with Sprinklr

Enter the IAM role ARN in the Source Specific Settings screen while configuring Unified Data Connector.